"event snmp oid" error when return is an IP address

[KenHolloway]

I want to send an alert when the HSRP Standby address is "unknown". My thought was to use "event snmp oid" as follows:

snmp-server ifindex persist

track 401 stub-object

event manager applet hsrpStandby901Down
event snmp oid 1.3.6.1.4.1.9.9.106.1.2.1.1.14.3.401 get-type exact entry-op eq entry-val "0.0.0.0" entry-type value exit-op ne exit-val "0.0.0.0" exit-type value poll-interval 5 maxrun 300
action a01 track set 401 state down

However, this is generating the following repeating error:

Jan 23 12:30:32: %HA_EM-7-FMFD_INV_STATS_TYPE: snmp_value_compare: invalid statistics value type: 64 -Process= "EEM ED SNMP", ipl= 0, pid= 378
-Traceback= 320320D8z 320330A8z 32033390z 3201683Cz 33B3175Cz 33B3403Cz 33B25A64z 33B271E8z 32019430z 320344ECz 300329C8z 300329ACz

Is seems that "event snmp oid" does not like when the return is an IP address. Is there another syntax I need to use for IP addresses? Or, another way to detect when the HSRP Standby address is "unknown"?

I am pretty sure the OID is correct:

WC-2911-1#snmp get v2c 192.168.16.2 public oid 1.3.6.1.4.1.9.9.106.1.2.1.1.14.3.401
SNMP Response: reqid 22, errstat 0, erridx 0
cHsrpGrpEntry.14.3.401 = 12.161.171.125

[Joe Clarke]

This looks like a bug.  At the very least you shouldn't see a traceback.  You could open a TAC case to look at the underlying problem.

As for a workaround to the overall problem, what does cHsrpGrpStandbyState.3.401 report when the standby is unknown?  You might be able to build your applet to look at values less than 5.

[KenHolloway]

"Bug" was the first thing I thought, so TAC is where I had started (case 681617444). They said:

The message is generated because you used invalid value type in your script. For your questions you can reach out to the support community. Cisco Support Forums has dedicated people that will assist you in matters that sometimes are out of TAC scope. They will give you better advice how to proceed with this.

I will go back to TAC with your response....

As for the work-around - unfortunately, cHsrpGrpStandbyState is showing "6" regardless of the Standby address:

WC-2911-1#show standby brief
 P indicates configured to preempt.
 |
Interface Grp Pri P State Active Standby Virtual IP
Gi0/0.16 416 102 P Active local 192.168.16.3 192.168.16.1
Gi0/0.17 417 102 P Active local unknown 192.168.17.1
Gi0/0.18 418 102 P Active local unknown 192.168.18.1
Gi0/0.19 419 102 P Active local unknown 192.168.19.1
Gi0/1 401 102 P Active local 12.161.171.125 12.161.171.126
Gi0/2 402 102 P Active local 50.197.134.243 50.197.134.241
Vl10 410 102 P Active local 192.168.10.5 192.168.10.1

snmpwalk -v2c -cpublic 192.168.16.2 1.3.6.1.4.1.9.9.106.1.2.1.1.15
SNMPv2-SMI::enterprises.9.9.106.1.2.1.1.15.3.401 = INTEGER: 6
SNMPv2-SMI::enterprises.9.9.106.1.2.1.1.15.4.402 = INTEGER: 6
SNMPv2-SMI::enterprises.9.9.106.1.2.1.1.15.14.416 = INTEGER: 6
SNMPv2-SMI::enterprises.9.9.106.1.2.1.1.15.16.417 = INTEGER: 6
SNMPv2-SMI::enterprises.9.9.106.1.2.1.1.15.17.418 = INTEGER: 6
SNMPv2-SMI::enterprises.9.9.106.1.2.1.1.15.18.419 = INTEGER: 6
SNMPv2-SMI::enterprises.9.9.106.1.2.1.1.15.20.410 = INTEGER: 6

[Joe Clarke]

The type of IP address could be evaluated.  It's not your script that's wrong per se.

Beyond that, you could use CLI scraping to look at the standby address and fire your alarm based on that.

[KenHolloway]

"CLI scraping"? Do you mean something like "show standby brief | include unknown", then check to see if there was any output? If so, any hints or references to the "check to see if there was any output" part?

[Joe Clarke]

It could be as simple as:

cli command "show stand brief | inc unknown"

regexp "unknown" "$_cli_result"

if $_regexp_result eq 1

track set ...

end

If you want to do more complex searching of the output you can with that regexp action.

[KenHolloway]

Hi Joe,

This is working great. Thanks for your help.

I will post here if I hear anything useful back from TAC.

Thanks,

Ken